Key points
- The vulnerability enables denial of service through asymmetric resource consumption over a network.
- Affected packages include System.Security.Cryptography.Xml versions 8 through 11.
- Microsoft has released patched versions for all supported .NET lines.
An unauthenticated attacker can force a denial of service on systems running vulnerable .NET code. This capability exists because the application consumes resources at a rate disproportionate to the input provided.
Microsoft confirmed the issue affects the System.Security.Cryptography.Xml package. The flaw allows an attacker to deny service over a network without needing credentials. The CVSS score is 7.5, rated as high severity.
Scope of the issue
The vulnerability stems from asymmetric resource consumption, also known as amplification. An attacker sends a small input that triggers significant processing on the server side. This imbalance drains system resources, leading to service disruption for legitimate users.
Who is affected
Developers using specific versions of the System.Security.Cryptography.Xml NuGet package are exposed. This includes versions 8.0.0 through 8.0.4, 9.0.0 through 9.0.20, 10.0.0 through 10.0.12, and preview releases of version 11.
The flaw impacts applications on Windows, Linux and macOS across all architectures. Any project relying on these library versions for XML cryptography operations inherits the risk. Teams must check their dependency trees to identify usage.
What happens next
Microsoft has released patched versions for all affected lines. Version 8.0.5, 9.0.21, 10.0.13 and 11.0.0-rc.2 contain the fixes. Developers should update their NuGet packages to these versions immediately.
The patches add limits on input depth and operation counts. They also prohibit DTD processing by default and validate entity references. These changes bound the processing of encrypted data and cap attributes used by C14N transforms.
Why this attack works
Teams usually encounter these flaws when parsing untrusted data structures. The weakness relies on the application performing complex operations based on minimal input. Attackers exploit this imbalance to exhaust memory or CPU cycles. This stage of an intrusion serves to disrupt availability rather than steal data. Check whether your services validate input size before processing. Ensure that parsing libraries have strict limits on recursion and entity expansion. Monitor resource usage spikes during XML handling to detect abuse early.
What to do and how to stay safe: Microsoft
- Audit your project dependencies to identify if you use the vulnerable System.Security.Cryptography.Xml versions.
- Update to the patched versions listed in the advisory as soon as possible.
- Implement input validation to restrict the size and complexity of XML data accepted by your services.
- Monitor server resource metrics for sudden spikes that may indicate an ongoing amplification attack.
Step-by-step guide: Patch Management Policy: How to Automate Fixes Without Breaking Systems
General security guidance from the Payload Report newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-96960?
The vulnerability has a CVSS 3.1 score of 7.5, which is rated as high severity.
Which platforms are affected by this vulnerability?
The flaw affects applications running on Windows, Linux and macOS across all architectures.
How do I know if my application is vulnerable?
You are affected if your project uses the System.Security.Cryptography.Xml package within the specified vulnerable version ranges.
